GHSA-fj7c-vg2v-ccrm: High severity Red Hat Undertow vulnerability

Published Aug 23, 2022

Updated

A flaw was found in Undertow. A buffer leak on the incoming WebSocket PONG message may lead to memory exhaustion. This flaw allows an attacker to cause a denial of service. The highest threat from this vulnerability is availability.

Affected Software

1 affected component

Red Hat Undertow

Event History

Aug 23, 2022

CVE Published

via OSV·04:15 PM

Data Sourced

via OSV·04:15 PM

DescriptionSeverity

Frequently Asked Questions

Who can exploit this issue?

An attacker able to send WebSocket PONG messages to a vulnerable Undertow service can trigger the buffer leak. No privileges or user interaction are required, and the attack can be performed over the network.

What is the practical impact?

Repeated incoming WebSocket PONG messages can leak buffers until available memory is exhausted, causing a denial of service. The provided severity vector indicates no confidentiality or integrity impact.

How can I determine whether a service may be affected?

Assess whether the service uses Red Hat Undertow and accepts WebSocket connections that can receive PONG messages. The provided data does not identify affected or fixed Undertow versions.

GHSA-fj7c-vg2v-ccrm: High severity Red Hat Undertow vulnerability

Affected Software

Event History

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact?

How can I determine whether a service may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who can exploit this issue?

What is the practical impact?

How can I determine whether a service may be affected?